Introduction to Microsoft Defender XDR
- Understanding Microsoft Defender XDR and unified threat protection
- Exploring the role of Microsoft Defender XDR within modern security operations
- Understanding how integrated security signals improve threat visibility
- Reviewing the responsibilities of a Security Operations Analyst
- Navigating the Microsoft Defender portal and associated services
Mitigating incidents using Microsoft Defender
- Understanding incident management workflows
- Investigating alerts and correlated incidents
- Analysing attack timelines and threat intelligence
- Managing incident prioritisation and remediation activities
- Using Microsoft Defender tools to reduce organisational risk
- Applying best practices for effective incident response
Deploying Microsoft Defender for Endpoint
- Understanding Microsoft Defender for Endpoint architecture
- Preparing endpoint environments for deployment
- Configuring onboarding and device management settings
- Managing endpoint security policies and compliance requirements
- Validating deployment readiness across organisational environments
- Reviewing deployment considerations for enterprise-scale environments
Configuring alerts and detections
- Understanding detection rules and alert generation
- Configuring endpoint detection and response settings
- Managing alert tuning to reduce false positives
- Reviewing automated investigation and remediation capabilities
- Analysing threat indicators and suspicious behaviour patterns
- Supporting operational monitoring through effective detection strategies
Managing automation in Microsoft Defender for Endpoint
- Understanding security automation concepts
- Configuring automated investigation and remediation workflows
- Managing automation levels and response actions
- Reviewing automation use cases for security operations teams
- Improving operational efficiency through automated security processes
- Monitoring and validating automated response activities
Performing device investigations
- Investigating compromised or suspicious devices
- Reviewing device timelines and behavioural data
- Analysing user activity and endpoint events
- Identifying indicators of compromise and lateral movement activity
- Using advanced hunting and KQL queries to investigate threats
- Supporting remediation and recovery activities following investigations
Threat hunting and operational response
- Understanding proactive threat hunting methodologies
- Using Microsoft Defender XDR to search for suspicious activity
- Correlating data across endpoints, identities, email, and applications
- Investigating attack chains and persistence mechanisms
- Supporting collaboration between security and operational teams
- Applying organisational context to threat response activities
Applied labs and cyberthreat defence exercises
- Completing guided Microsoft Defender XDR lab exercises
- Investigating simulated security incidents in controlled environments
- Practising real-world threat response workflows
- Applying endpoint investigation and mitigation techniques
- Performing alert analysis and remediation tasks
- Reinforcing practical security operations skills through hands-on learning
Best practices for security operations teams
- Strengthening organisational cyber resilience
- Improving visibility across security operations environments
- Supporting collaboration between security stakeholders
- Applying security monitoring and response best practices
- Developing scalable approaches to threat detection and remediation
- Aligning Microsoft Defender XDR capabilities to organisational security goals
Exams and assessments
This course aligns to the Microsoft Applied Skills assessment: Defend against cyberthreats with Microsoft Defender XDR.
Learners will reinforce their knowledge through:
- Knowledge checks throughout the course
- Guided practical exercises and applied labs
- Threat investigation activities and scenario-based tasks
- Hands-on Microsoft Defender XDR exercises
There is no formal QA exam included as part of the course delivery.
Hands-on learning
This course includes practical, hands-on learning throughout, helping learners apply skills directly in Microsoft Defender XDR environments.
Learners will participate in:
- Guided labs using Microsoft Defender XDR and Defender for Endpoint
- Threat investigation and remediation exercises
- Practical alert analysis and response scenarios
- Instructor-led demonstrations and operational walkthroughs
- Applied exercises using real-world security operations workflows
We believe applied learning is essential for organisations building effective cyber defence capabilities. This course combines technical instruction with practical exercises designed to support operational confidence and faster skills application.
